Analysis
- user interaction
yes - max time kernel
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 09:49
General
- Target cr-keygen.exe
- Size 688KB
- Sample261024-ltmkhag151
- SHA256 05b4dffe16c941e1c64357c9d13673b58f6d1dcc0deeb11759851957d0d08d49
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cr-keygen.exe"C:\Users\Admin\AppData\Local\Temp\cr-keygen.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
IKlSstcimTFTUCkeEAxh.DLL
IPjmUfpvWjWeHotYBxhc.DLL
IbIqZQyKAI.DLL
memory/3476-40-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-2-0x0000000002360000-0x00000000023AA000-memory.dmp
memory/3476-13-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-12-0x000000000046A000-0x000000000046B000-memory.dmp
memory/3476-10-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-9-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-8-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-3-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-7-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-6-0x0000000000860000-0x000000000086C000-memory.dmp
memory/3476-34-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-35-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-33-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-43-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-4-0x0000000000710000-0x0000000000711000-memory.dmp
memory/3476-41-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-1-0x0000000002360000-0x00000000023AA000-memory.dmp
memory/3476-36-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-37-0x0000000002360000-0x00000000023AA000-memory.dmp
memory/3476-38-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-39-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-0-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-11-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-42-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-5-0x0000000000720000-0x0000000000730000-memory.dmp
memory/3476-44-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-45-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-46-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-47-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-49-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-48-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-51-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-50-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-53-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-52-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-55-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-54-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-57-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-56-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-59-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-58-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-61-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-60-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3476-63-0x0000000004400000-0x0000000004413000-memory.dmp
memory/3476-62-0x0000000000400000-0x0000000000578000-memory.dmp